@socketsecurity/lib 4.0.1 → 4.1.0

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.0](https://github.com/SocketDev/socket-lib/releases/tag/v4.1.0) - 2025-11-17
+
+### Added
+
+- **constants/node**: New version helper functions for cleaner version detection
+  - `getNodeMinorVersion()`: Extract minor version number
+  - `getNodePatchVersion()`: Extract patch version number
+
+### Fixed
+
+- **constants/node**: Improve Node.js flag management in `getNodeHardenFlags()`
+  - Properly guard `--experimental-permission` for Node 20-23 only
+  - Properly guard `--permission` for Node 24+ only
+  - Properly guard `--force-node-api-uncaught-exceptions-policy` for Node 22+ (was incorrectly applied to all versions)
+  - Automatically include permission grants from `getNodePermissionFlags()` for Node 24+
+  - Remove `--experimental-policy` flag (no policy file provided)
+
 ## [4.0.1](https://github.com/SocketDev/socket-lib/releases/tag/v4.0.1) - 2025-11-17
 
 ### Changed

package/dist/constants/node.d.ts

@@ -1,6 +1,8 @@
 // Version detection.
 export declare function getNodeVersion(): string;
 export declare function getNodeMajorVersion(): number;
+export declare function getNodeMinorVersion(): number;
+export declare function getNodePatchVersion(): number;
 // Maintained Node.js versions.
 export declare function getMaintainedNodeVersions(): readonly string[] & {
     current: string;
@@ -18,8 +20,8 @@ export declare function supportsNodeRun(): boolean;
 export declare function supportsNodeDisableSigusr1Flag(): boolean;
 export declare function getNodeDisableSigusr1Flags(): string[];
 export declare function supportsProcessSend(): boolean;
-export declare function getNodeHardenFlags(): string[];
 export declare function getNodePermissionFlags(): string[];
+export declare function getNodeHardenFlags(): string[];
 export declare function getNodeNoWarningsFlags(): string[];
 // Execution path.
 export declare function getExecPath(): string;

package/dist/constants/node.js

@@ -26,7 +26,9 @@ __export(node_exports, {
   getNodeDisableSigusr1Flags: () => getNodeDisableSigusr1Flags,
   getNodeHardenFlags: () => getNodeHardenFlags,
   getNodeMajorVersion: () => getNodeMajorVersion,
+  getNodeMinorVersion: () => getNodeMinorVersion,
   getNodeNoWarningsFlags: () => getNodeNoWarningsFlags,
+  getNodePatchVersion: () => getNodePatchVersion,
   getNodePermissionFlags: () => getNodePermissionFlags,
   getNodeVersion: () => getNodeVersion,
   supportsNodeCompileCacheApi: () => supportsNodeCompileCacheApi,
@@ -45,7 +47,13 @@ function getNodeVersion() {
   return NODE_VERSION;
 }
 function getNodeMajorVersion() {
-  return Number.parseInt(NODE_VERSION.slice(1).split(".")[0] || "0", 10);
+  return Number.parseInt(NODE_VERSION.slice(1).split(".")[0] ?? "0", 10);
+}
+function getNodeMinorVersion() {
+  return Number.parseInt(NODE_VERSION.split(".")[1] ?? "0", 10);
+}
+function getNodePatchVersion() {
+  return Number.parseInt(NODE_VERSION.split(".")[2] ?? "0", 10);
 }
 function getMaintainedNodeVersions() {
   return import_maintained_node_versions.maintainedNodeVersions;
@@ -68,24 +76,22 @@ function supportsNodePermissionFlag() {
 }
 function supportsNodeRequireModule() {
   const major = getNodeMajorVersion();
-  return major >= 23 || major === 22 && Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10) >= 12;
+  return major >= 23 || major === 22 && getNodeMinorVersion() >= 12;
 }
 function supportsNodeRun() {
   const major = getNodeMajorVersion();
-  return major >= 23 || major === 22 && Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10) >= 11;
+  return major >= 23 || major === 22 && getNodeMinorVersion() >= 11;
 }
 function supportsNodeDisableSigusr1Flag() {
   const major = getNodeMajorVersion();
+  const minor = getNodeMinorVersion();
   if (major >= 24) {
-    const minor = Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10);
     return minor >= 8;
   }
   if (major === 23) {
-    const minor = Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10);
     return minor >= 7;
   }
   if (major === 22) {
-    const minor = Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10);
     return minor >= 14;
   }
   return false;
@@ -101,24 +107,6 @@ function supportsProcessSend() {
   return typeof process.send === "function";
 }
 let _nodeHardenFlags;
-function getNodeHardenFlags() {
-  if (_nodeHardenFlags === void 0) {
-    const major = getNodeMajorVersion();
-    const flags = [
-      "--disable-proto=delete",
-      // Node.js 24+ uses --permission instead of --experimental-permission.
-      // The permission model graduated from experimental to production-ready.
-      major >= 24 ? "--permission" : "--experimental-permission",
-      // Force uncaught exceptions policy for N-API addons (Node.js 22+).
-      "--force-node-api-uncaught-exceptions-policy"
-    ];
-    if (major < 24) {
-      flags.push("--experimental-policy");
-    }
-    _nodeHardenFlags = flags;
-  }
-  return _nodeHardenFlags;
-}
 let _nodePermissionFlags;
 function getNodePermissionFlags() {
   if (_nodePermissionFlags === void 0) {
@@ -138,6 +126,23 @@ function getNodePermissionFlags() {
   }
   return _nodePermissionFlags;
 }
+function getNodeHardenFlags() {
+  if (_nodeHardenFlags === void 0) {
+    const major = getNodeMajorVersion();
+    const flags = ["--disable-proto=delete"];
+    if (major >= 24) {
+      flags.push("--permission");
+      flags.push(...getNodePermissionFlags());
+    } else if (major >= 20) {
+      flags.push("--experimental-permission");
+    }
+    if (major >= 22) {
+      flags.push("--force-node-api-uncaught-exceptions-policy");
+    }
+    _nodeHardenFlags = flags;
+  }
+  return _nodeHardenFlags;
+}
 let _nodeNoWarningsFlags;
 function getNodeNoWarningsFlags() {
   if (_nodeNoWarningsFlags === void 0) {
@@ -159,7 +164,9 @@ const ESNEXT = "esnext";
   getNodeDisableSigusr1Flags,
   getNodeHardenFlags,
   getNodeMajorVersion,
+  getNodeMinorVersion,
   getNodeNoWarningsFlags,
+  getNodePatchVersion,
   getNodePermissionFlags,
   getNodeVersion,
   supportsNodeCompileCacheApi,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "4.0.1",
+  "version": "4.1.0",
   "packageManager": "pnpm@10.22.0",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
@@ -690,7 +690,7 @@
     "@socketregistry/is-unicode-supported": "1.0.5",
     "@socketregistry/packageurl-js": "1.3.5",
     "@socketregistry/yocto-spinner": "1.0.25",
-    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@4.0.0",
+    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@4.0.1",
     "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20250920.1",
     "@vitest/coverage-v8": "4.0.3",